Indian Business Consultant Says U.S. Largely Responsible For Demand For Black Market Medical Records
From Na Vijayashankar ("Naavi") at www.naavi.org comes a strong response to the Indian black market medical records scandal in general and the resulting comments by Webmedx CEO Sean Carroll in particular (emphases mine):
"To put the incident in the proper perspective, we can recall the many data breach incidents that have occurred in the U.S. itself, where millions of records have been compromised--some out of financial inducements, many through negligence and many more due to criminals who hack into systems as a profession. IS [information security] is therefore as much an issue in the U.S. as it is in India.
"The reason for increasing data breaches of the kind referred to in the instant case is the growing cyber crime underworld which finds all means of stealing data because there is a market for the same. In the case of health records coming under HIPAA, the beneficiaries are in the U.S. Many of them are the insurance companies who follow unscrupulous methods to obtain data that can be used for marketing. It is therefore the unethical business practices of the U.S. insurance companies that cause a fertile ground for the proliferation of the data breach incidents. Part of the solution therefore lies within the U.S. jurisdiction on how to promote ethical business practices. I would request Sean Carroll to find means of spreading this message in the industry in the U.S."
Naavi further alleges that although Indian business process outsourcing (BPO) firms, including medical transcription service providers, do indeed need to pay more attention to security, the onus is on U.S.-based clients and primary contractors to put pressure on their outsourcing partners to adhere to HIPAA standards:
"On the other hand, I would also request the U.S. companies outsourcing health care business to India to insist that their clients in India must undergo a 'HIPAA-HITECH Compliance Drill.' I have observed that many Indian companies are not aware of their responsibilities. This lack of awareness is also indicative that the U.S. vendors are not driving home the requirement of HIPAA compliance in their SLAs. Perhaps they have exchanged a contract which indirectly talks of an indemnity. This is more a legal formality they have undergone rather than a real effort to educate their counterparts. Let it be one of the HIPAA compliance requirements of the U.S. companies that they have specifically inquired with their Indian counterparts about the HIPAA compliance measures undertaken in India and obtain certifications. Not all these certificates would be reliable, but many would be.
"Many of the HIPAA awareness programmes I have conducted, and audits I have participated in are a result of the initiative of the local companies to improve their competitiveness. This indicates that there is a desire in India for companies to adopt IS standards. Like in every other case of motivation, they perhaps need a little nudging, little coercion and little incentivisation.
"I would request U.S. companies not to treat HIPAA compliance as a paper formality to be completed. Let it be a genuine exercise to promote IS culture. Let the U.S. vendors insist in their business contracts that Indian medical transcription partners must only engage employees who have undergone a 'HIPAA Awareness Training' and send documentary proof for having conducted such programme for their employees. U.S. companies can also devise strategies where they earmark a part of their payments to be released only towards expenses in employee training and other HIPAA initiatives. (Extension of Obama’s strategy of incentivisation of adoption of EHRs by medical practitioners).
"The sting report is therefore a wake up call as much to the U.S. companies as it is to the Indian companies. Let’s work together in the effort to have adequate information security without losing out on the outsourcing advantages."
Clearly the Indian BPO industry is rightfully concerned about the potential fall-out from data breaches of U.S. health information. Time will tell whether or not this blame-the-greedy-Americans strategy is the best way to go about reassuring the U.S. citizenry and regulatory bodies that our medical records are safe in foreign hands.
On the other hand, this blogger does raise some important issues that shouldn't be summarily dismissed merely because of the rather belligerent (not to mention somewhat self-serving) tone in which they are presented. As I have said in the past, many of the concerns regarding the safety of foreign outsourcing of protected health information (PHI) are just as applicable to the domestic outsourcing MT industry that relies heavily on home-based practitioners. It's my firm belief that the increased focus on PHI security as a result of HITECH truly is, as Naavi says, a "wake up call" to the medical transcription industry, both here and abroad. To mix a couple of metaphors, before casting stones at the practice of offshore outsourcing, we'd best make sure the glass-housed domestic MT workforce is without sin as well.